Re: [PATCH] signal: Prevent sigqueue caching after task got released

[Thomas Gleixner]

On Tue, Jun 22 2021 at 08:34, Oleg Nesterov wrote:
> On 06/22, Thomas Gleixner wrote:
>
> I guess you mean the race with exit_notify() ? Could you spell please?

Yes let me rephrase that.

> I am just curious how exactly this problem was found.

I was looking at that syzbot report

  https://lore.kernel.org/r/000000000000148b4b05c419cbbb@xxxxxxxxxx

and analyzed it how this ends up leaking memory.

> This doesn't really matter, because damn yes, a task T can call
> release_task(another_task)->sigqueue_cache_or_free() after
> exit_task_sigqueue_cache(T) was already called. For example, a last non-leader
> thread exits and reaps a zombie leader.
>
> Somehow I thought that exit_task_sigqueue_cache() at the end of __exit_signal()
> should fix this problem, but this is obviously wrong.
>
>
>> @@ -463,13 +469,18 @@ void exit_task_sigqueue_cache(struct tas
>>  	struct sigqueue *q = tsk->sigqueue_cache;
>>  
>>  	if (q) {
>> -		tsk->sigqueue_cache = NULL;
>>  		/*
>>  		 * Hand it back to the cache as the task might
>>  		 * be self reaping which would leak the object.
>>  		 */
>>  		 kmem_cache_free(sigqueue_cachep, q);
>>  	}
>> +
>> +	/*
>> +	 * Set an error pointer to ensure that @tsk will not cache a
>> +	 * sigqueue when it is reaping it's child tasks
>> +	 */
>> +	tsk->sigqueue_cache = ERR_PTR(-1);
>>  }
>
>
> Reviewed-by: Oleg Nesterov <oleg@xxxxxxxxxx>